--- a/syslog2iptables.conf	Thu May 29 11:44:36 2008 -0700
+++ b/syslog2iptables.conf	Wed Dec 24 18:40:54 2008 -0800
@@ -26,6 +26,19 @@
         bucket 400;
         message "ssh failed password";
     };
+    pattern "proftpd.*no such user found from (.*) \[" {
+        index 1;    // zero based
+        bucket 400;
+        message "ftp failed password";
+    };
+};
+
+file "/var/log/messages" {
+    pattern "ipop3d.* Login failed .* \[(.*)\]" {
+        index 1;    // zero based
+        bucket 400;
+        message "pop3 failed password";
+    };
 };
 
 file "/var/log/httpd/access_log" {
@@ -47,14 +60,44 @@
         bucket 400;
         message "apache main.php reference";
     };
+    pattern "(.*) - - .*/awstats.pl" {
+        index 1;    // zero based
+        bucket 400;
+        message "apache awstats.pl reference";
+    };
+    pattern "(.*) - - .*/adxmlrpc" {
+        index 1;    // zero based
+        bucket 400;
+        message "apache adxmlrpc reference";
+    };
 };
 
 file "/var/log/maillog" {
-    pattern "lost input channel from .* \[(.*)\] .* after mail" {
+    pattern "lost input channel from .* \[(.*)\] .* after (mail|rcpt|auth)" {
         index 1;    // zero based
         bucket 200;
         message "sendmail spammer dropping connection";
     };
+    pattern " \[(.*)\]: possible SMTP attack" {
+        index 1;    // zero based
+        bucket 600;
+        message "sendmail authentication attack";
+    };
+    pattern "rejecting commands from .* \[(.*)\] due to pre-greeting traffic" {
+        index 1;    // zero based
+        bucket 200;
+        message "sendmail pre-greeting";
+    };
+    pattern "dovecot.*Aborted login.*rip=(.*)," {
+        index 1;    // zero based
+        bucket 100;
+        message "dovecot failed password";
+    };
+    pattern "dovecot: pop3-login: Disconnected: Shutting down.*rip=(.*)," {
+        index 1;    // zero based
+        bucket 100;
+        message "dovecot failed password";
+    };
 
     // make sure your upstream MX servers are listed in the
     // ignore block above, otherwise you will kill them off